Alertas de Seguridad de la Información

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92961] vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArra…

vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.

nvdaltovulnerabilidad CVSS 7.5 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92970] HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers t…

HUBzero CMS through 2.2.32 contains a path traversal vulnerability in project file upload handlers that allows authenticated project members to write arbitrary files outside the project repository. Attackers can supply traversal sequences in upload parameters to write files to attacker-chosen paths with web server privileges, potentially enabling code execution.

nvdaltovulnerabilidad CVSS 8.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92953] vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes fr…

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92954] vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3…

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92955] vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access …

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92956] vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sand…

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the h…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92957] vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-suppl…

vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92958] vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the b…

vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can there…

nvdaltovulnerabilidad CVSS 8.5 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92947] vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host m…

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92948] vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a…

vm2 versions >= 3.9.6 and

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92950] vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to e…

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.

nvdaltovulnerabilidad CVSS 8.6 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92951] vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlis…

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92940] vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed cod…

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unr…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92941] vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a…

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-co…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Alto vulnerabilidad

17/09/2026

[CVE-2026-92942] vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code …

vm2 before 3.11.7 (affected versions

nvdaltovulnerabilidad CVSS 7.5 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92944] vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promis…

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92946] vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled wi…

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92937] vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js pr…

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host Promise value. Registering the rejection handler through Function.prototype.call or .apply indirection (e.…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92938] vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeV…

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and t…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92939] vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto…

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an u…

nvdcriticovulnerabilidad CVSS 9.9 NVD